The present invention relates to a quantum cryptography communication method, a quantum cryptography communication apparatus, and a quantum cryptography communication system. More particularly, the present invention relates to a quantum cryptography communication method, a quantum cryptography communication apparatus, and a quantum cryptography communication system, allowing an information communication process and an information sharing process to be efficiently performed in a process of transmitting and sharing secret information using quantum cryptography.
In recent years, network communications and electronic commerce have become popular. As a result, it has become very important to achieve security in communication. To achieve security, various techniques of cryptography are used in communication.
The cryptography can be roughly classified into two groups; symmetric key cryptography, and public key cryptography. In the symmetric key cryptography, which is also called the symmetric cryptography, both a sender and a receiver have an identical secret key. A representative example of the symmetric key cryptography is DES (Data Encryption Standard) cryptography. The feature of the DES cryptography is that encryption and decryption can be performed by substantially the same algorithm.
In the public key cryptography or the asymmetric cryptography, unlike the symmetric key cryptography, a sender and a receiver use different keys. In the public key cryptography, unlike the symmetric key cryptography in which the same secret key is used in both encryption and decryption, a secret key that must be kept secret is possessed by a particular single person, and thus it is possible to easily manage the key. However, in the public key cryptography, a longer data processing time is needed than in the symmetric key cryptography, and the public key cryptography is used mainly in applications, such as transmission of a secret key or digital signature, in which a rather small amount of data is treated. A representative method of the public key cryptography is RSA (Rivest-Shamir-Adleman) cryptography. In the RSA cryptography, the product of two very large prime numbers (as large as, for example, 150-digit numbers) is used. That is, the RSA cryptography is based on the difficulty of factorization of the product of two large prime numbers into prime factors.
However, it is known that the difficulty in the factorization calculation will be overcome by a quantum computer based on the principles of the quantum mechanics. Besides it has not been proved in information theory that the difficulty in the factorization calculation is essential, and there is a possibility that an efficient algorithm of factorization using a conventional computer will be found. This means that the security of the public key cryptography is not perfect.
On the other hand, in the symmetric key cryptography in which a secret key is shared, it is required that the shared secret key should be kept secret from a third person. For example, when the secret key is transmitted via a network to share it, it is required to take sufficient measures to prevent the secret key from being eavesdropped when the secret key is transmitted via the network.
Use of quantum cryptography ensures that the secret key can be shared in a secure manner based on the physical laws. Communication of secret information using quantum cryptography is accomplished by transmitting weak signal light (for example, having a single photon) via an optical fiber or the like. The security of communication of secret information using quantum cryptography is based on the fact that when a quantum-encrypted signal received via a communication channel is detected, a correct state of weak light carrying the quantum-encrypted signal cannot be determined by a single measurement.
The outline of communication of secret information using quantum cryptography is described below. The sharing of the secret data is basically accomplished by transmitting polarized or phase-modulated light from a sending side to a receiving side, and detecting it on the receiving side.
An example of a communication process of secret information based on phase modulation is described below with reference to figures. As shown in FIG. 1A, a sender (Alice) 10 transmits a light signal to a receiver (Bob) 20 via a data communication channel 30 such as an optical fiber.
On the side of the sender (Alice) 10, coherent light is phase-modulated by an angle equal to one of 0, π/2, π, and 3π/2 by using a modulator 11, and resultant phase-modulated light is output. More specifically, for example, as shown in FIG. 1B, light is phase-modulated by a 0 or π/2 for each bit 0, and by π or 3π/2 for each bit 1.
For example, when a bit sequence shown in the upper row (a) in a table shown in FIG. 1C is given as a selected bit sequence, a phase-modulated sequence signal shown in the lower row (b) in the table is output as phase-modulated light from the modulator 11 and is transmitted to the receiver (Bob) 20. Although in the present example, after a selected bit sequence is set, for example, as shown in the row (a), the modulation process is performed in accordance with the selected bit sequence, the modulation process may be performed in accordance with a random bit sequence without using a selected bit sequence. That is, without setting the selected bit sequence shown in the row (a), the phase modulation may be randomly performed as shown in the row (b), and the bit sequence corresponding to the phase-modulated bit sequence shown in the row (b) may be determined as the selected bit sequence shown in the row (a).
On the side of the receiver (Bob) 20, a process is performed as described below with reference to FIG. 2. That is, on the side of the receiver (Bob) 20, an observation device 21 randomly selects either 0 or π/2 and performs phase modulation by the randomly selected angle. The observation device 21 then measures resultant interference. In the interference measurement, interference can be observed in the following two cases.
(1) When phase modulation is performed by 0 or π on the data sending side, and phase modulation of 0 is performed by the observation device 21.
(2) When phase modulation is performed by π/2 or π/2 on the data sending side, and phase modulation of π/2 is performed by the observation device 21.
For any other combination, detection of bits based on interference is impossible. For example, if the observation device 21 on the side of the receiver (Bob) 20 performs phase modulation as shown in a row (c) of a table shown in FIG. 2B, bits are detected as shown in a row (d) of the table. In the row (d) indicating bit data detected based on interference, 0 or 1 is obtained as a detection result when the condition (1) or (2) described above is satisfied. In the row (d), symbols x denote bits that are undetectable because neither the condition (1) nor the condition (2) is satisfied.
As shown in FIG. 3, the receiver (Bob) 20 transmits information indicating the sequence of phase modulation modes applied in the observation device 21 on the side of the receiver (Bob) 20, that is, the receiver (Bob) 20 transmits the information sequence (0, 0, π/2, π/2, 0, . . . ) shown in the row (c) of the table shown in FIG. 3B to the sender (Alice) 10.
Based on the information indicating the sequence of phase modulation modes received from the receiver (Bob) 20, the sender (Alice) 10 generates information indicating positions at which modulation was correctly performed, that is, the condition (1) or (2) is satisfied and thus bits were detected, and positions at which modulation was incorrectly performed and thus the conditions (1) and (2) were not satisfied, and the sender (Alice) 10 transmits the generated information to the receiver (Bob) 20. In the present example, the information sequence (o, x, o, x, o, o) shown in the row (e) of the table shown in FIG. 3B is transmitted to the receiver (Bob) 20.
Note that the sequence of phase modification modes (0, 0, π/2, π/2, 0, . . . ) shown in the row (c) of the table shown in FIG. 3B and the information sequence (o, x, o, x, o, o) shown in the row (e) of the table shown in FIG. 3B may be transmitted respectively from the receiver (Bob) 20 and the sender (Alice) 10 via a public communication channel.
As shown in FIG. 4A, the receiver (Bob) 20 informs the sender (Alice) 10 of the bit information sequence (0, 0, 1, 0, . . . ) detected by the observation device 21. On the other hand, the sender (Alice) 10 informs the receiver (Bob) 20 of bit sequence information (0, 0, 1, 0, . . . ) including only bits at positions at which the condition (1) or (2) is satisfied. That is, in the row (a) of the table shown in FIG. 4B, bits are selected from those bits at positions corresponding to symbols o in the row (e) where phase modulation modes are matched between the sending side and the receiving side, and a sequence of the selected bits is transmitted. Also in this case, the transmission may be performed via a public communication channel.
When the communicating data transmitted via the data communication channel 30 is not eavesdropped, sequences of detected bits mutually transmitted for confirmation as shown in FIG. 4A are equal to each other. However, if the communicating data transmitted via the data communication channel 30 is eavesdropped, a difference occurs between sequences of detected bits mutually transmitted for confirmation, as shown in FIG. 5. This means that eavesdropping of data transmitted via the data communication channel 30 results in a change in the modulation state. That is, no difference occurs between sequences of detected bits mutually transmitted for confirmation when the data transmitted via the data communication channel 30 is not eavesdropped.
Via the data communication performed in the above-described manner, secret information such as a secret key used in the symmetric key cryptography can be shared. For example, to share a secret key with n bits, a confirmation is first made as to the equality between mutually transmitted bit sequences as described above with reference to FIG. 4. After the confirmation is made, n bits are selected from m bits (m>n) shared via the above-described process.
In the above-described data communication using the quantum cryptography, the authorized receiver needs to detect weak light pulses transmitted from the sender. As for methods to detect weak light pulses, a single photon detection method and a homodyne detection method are known. In the homodyne detection method, the state of weak signal light (S) (whose average number of photons is about one) is measured by superimposing a relative strong reference light (L) (whose average number of photons is typically about 106) on the signal light (S).
Advantages of the homodyne detection method are the capability of operating at room temperature, the capability of measuring week light close to a lower theoretically limit using a currently available technique, and the capability of obtained detailed information about the states such as the probability distribution function of the orthogonal phase amplitude. Some signal detection methods used in the quantum cryptography are described, for example, in “Quantum Cryptography Using Pulsed Homodyne Detection” (T. Hirano, H. Yamanaka, M. Ashikaga, T. Konishi, and R. Namiki, Phys. Rev. A68,042331-1-7, 2003), “Security of Quantum Cryptography Using Balanced Homodyne Detection” (R. Namiki and T. Hirano, Physical Review, A67,022308, 2003), and Japanese Unexamined Patent Application Publication No. 2000-101570.
In the quantum cryptography using the homodyne detection, encoding using four states is performed based on the analogy to the single photon detection method. Therefore, in this method, one half of signals do not contribute to transmission of a secret key because of mismatching of the basis. That is, one half of transmitted signal pulses cannot make a contribution to carry information, and thus the coding efficiency cannot be greater than ½.
With reference to FIG. 6, a description will be given below as to the coding efficiency in quantum cryptography using the homodyne detection method. FIG. 6A shows four quantum states (coherent states) 51 to 54 of modulation signals generated in the phase modulation process performed on the sending side, and also shows two bases X1 (71) and X2 (72) used as the observation system in the phase modulation process performed on the receiving side.
When the basis (phase modulation mode applied on the receiving side) X1 71 is used as the observation system on the receiving side, of the four quantum states (coherent states) 51 to 54 obtained as a result of the phase modulation performed on the sending side, only the 0° phase modulation signal in the quantum state 51 and the 180° (π) phase modulation signal in the quantum state 53 can be detected, but the 90° (π/2) phase modulation signal in the quantum state 52 and the 270° (π/2) phase modulation signal in the quantum state 54 cannot be detected. When the basis (phase modulation mode applied on the receiving side) X2 72 is used as the observation system on the receiving side, of the four quantum states 51 to 54 obtained as a result of the phase modulation performed on the sending side, only the 90° (π/2) phase modulation signal in the quantum state 52 and the 270° (π/2) phase modulation signal in the quantum state 54 can be detected, but the 0° phase modulation signal in the quantum state 51 and the 180° (π) phase modulation signal in the quantum state 53 cannot be detected.
FIG. 6B is a table showing correspondence in terms of the states. In this table shown in FIG. 6B, angles of phase modulation (ΦA) performed on the data sending side are shown in a row (A), angles of phase modulation (ΦB) performed on the data receiving side are shown in a row (B), detected bits and information as to matching/mismatching in the basis are shown in a row (C), and the detectable bit ratio (basis matching ratio) is shown in a row (D).
As shown in the row (A) of the table, as a result of the phase modulation performed on the sending side, a phase modulation signal in one of the four quantum statues 51 to 54 corresponding respectively to the four phase modulation angles (ΦA) is generated. That is, one of the four phase modulation signals described below is generated.
0° phase modulation signal in the quantum state 51
90° (π/2) phase modulation signal in the quantum state 52
180° (π) phase modulation signal in the quantum state 53
270° (π/2) phase modulation signal in the quantum state 54
The row (B) shows the angles of phase modulation (ΦB) performed on the data receiving side, which correspond to two bases (phase modulation modes applied on the receiving side) employed as the observation system (shown in FIG. 6A) on the receiving side, that is, the basis (phase modulation mode applied on the receiving side) X1 71, and the basis (phase modulation mode applied on the receiving side) X2 72.
When the four phase modulation signals are arbitrarily and randomly selected on the sending side, and the two observation systems are randomly selected on the receiving side, eight combinations shown in FIG. 6B equally occur.
The row (C) in FIG. 6B shows detected bits and data as to the matching/mismatching in the basis. As described earlier, when the basis (phase modulation mode applied on the receiving side) X1 71 is used as the observation system on the receiving side, only the 0° phase modulation signal in the quantum state 51 and the 180° (π) phase modulation signal in the quantum state 53 can be detected, while when the basis (phase modulation mode applied on the receiving side) X2 72 is used as the observation system on the receiving side, only the 90° (π/2) phase modulation signal in the quantum state 52 and the 270° (π/2) phase modulation signal in the quantum state 54 can be detected.
The observation system used on the receiving side is referred to as the basis of phase modulation on the receiving side. When the basis allows the bit to be detected on the receiving side, the basis is said to be matched. On the other hand, when the basis does not allow the bit to be detected on the receiving side, the basis is said to be mismatched. As can be seen from FIG. 6B, of the total of eight combinations, the basis is matched in four combinations, but the basis is not matched in the other four combinations. Thus, as shown in the row (D) of the table shown in FIG. 6B, the probability that the basis is matched on the data receiving side and thus a bit can be detected is equal to ½ (50%).
The matching and mismatching of the basis are described in further detail below with reference to FIGS. 7A to 7D. FIG. 7A shows combinations of the angle of phase modulation performed on the sending side and the angle of phase modulation performed on the receiving side, in which the basis is matched.
That is, the basis is matched for the following four combinations: when the angle of phase modulation (ΦB) performed on the data receiving side is equal to π/2, and the angle of phase modulation (ΦA) performed on the data sending side is equal to π/2 or π/2, or when the angle of phase modulation (ΦB) performed on the data receiving side is equal to 0, and the angle of phase modulation (ΦA) performed on the data sending side is equal to 0 or π.
In any of these four combinations, the signal can be distinguishably detected on the receiving side, as shown in FIG. 7B. That is, when Φ=|ΦA−ΦB| is given as data from which to distinguishably detect the signal, the bit value can be identified by determining whether the phase of the detection signal is Φ=0 or Φ=π.
The process of detecting the signal when the basis is matched has been described above.
FIG. 7C shows combinations of the angle of phase modulation performed on the sending side and the angle of phase modulation performed on the receiving side, in which the basis is not matched.
That is, the basis is not matched in the following four combinations: when the angle of phase modulation performed on the receiving side is ΦB=0, and the angle of phase modulation performed on the sending side is ΦA=π/2 or π/2; and when the angle of phase modulation performed on the receiving side is ΦB=π/2, and the angle of phase modulation performed on the sending side is ΦA=0 or π.
In any of these combinations, as shown in FIG. 7D, the signal cannot be distinguishably detected on the receiving side. That is, when Φ=|ΦA−ΦB| is given as data, only a signal with Φ=±(π/2) is detected, and the bit value cannot be identified, because of mismatching of the basis.
When the basis is not matched, the signal cannot carry a bit value of the secret information to be shared by the data sending side and the data receiving side, and thus the signal is discarded. In other words, only when the basis is matched, the signal can carry a bit value of the secret information to be shared by the data sending side and the data receiving side. Of the signals that are phase-modulated on the sending side and transmitted to the receiving side, up to ½ of the signals can be effective, but the remaining signals are useless.
As described above, in the known method and apparatus for transmitting secret information using quantum cryptography, only up to ½ of signals that are phase-modulated on the sending side and transmitted to the receiving side are effective, and the remaining signals are useless. That is, the transmission efficiency is very low.